CVE-2026-14189

The WPBot WordPress plugin before 8.5.2 does not validate administrator-configured field identifiers before using them in a SQL query, allowing users with administrator access to perform SQL injection that executes when a visitor triggers a search...

CVE-2026-14189

The CVE covers the WPBot WordPress plugin prior to version 8.5.2. The root cause is failure to validate administrator-configured field identifiers before they are used in a SQL query, enabling a second-order SQL injection when a visitor triggers a search. The vulnerability can be exploited by use...